AI can give security operations center (SOC) analysts more room for complex investigations, but current evidence does not show that it causes broad skill loss. In Swimlane’s 2026 survey, 62% of respondents said AI improved their skill development, while 24% said it limited their ability to develop security skills. Those are self-reported perceptions from a vendor-sponsored survey—not measured changes in competence or proof of cause and effect.
What the survey says about analyst capacity and skills
Swimlane released The New SOC Career Ladder: How AI Is Reshaping the Security Operations Workforce on September 30, 2026. Sapio Research conducted the online survey between August and September 2026, interviewing 500 security operations professionals and leaders at companies with at least 500 employees in the United States and United Kingdom. Swimlane guided the research, and percentages were rounded to whole numbers. The results describe what respondents reported; they do not establish independently measured productivity, skill change, or labor-market outcomes. Swimlane’s survey release
Two additional capacity figures were reported by Infosecurity Magazine: 47% of respondents named greater capacity among AI’s two biggest impacts, and 35% said they had more time to investigate complex threats. Another 35% said they could focus more on strategic or cross-functional work. These figures are attributed to that secondary report; they are not shown in the Swimlane release text cited here. Infosecurity Magazine’s report
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →The skill responses are mixed rather than contradictory: people can experience AI as useful for learning while also feeling that it removes some opportunities to practise. In the Swimlane survey, 62% said AI had improved their skill development, and 24% said it had limited their ability to develop security skills. Neither response measures proficiency over time.
Why more capacity can coexist with less practice
Routine work can be both a workload and a learning opportunity. Automating repetitive triage may give analysts more time for difficult investigations, but repeated exposure to alerts, evidence gathering, and escalation decisions can also help less experienced staff build pattern recognition and judgment. Swimlane co-founder and CEO Cody Cornell put the concern this way: “The challenge is that routine work has also been one of the ways analysts learn the fundamentals.” He added: “As more of that work is automated, organizations need to rethink training and career paths so people still develop the judgment to know when AI is right and when it is not.” These are statements from a vendor representative, not independent findings. Swimlane’s survey release
The survey also points to concern about entry routes. Forty-seven percent of respondents expected AI to make cybersecurity harder to enter: 37% anticipated higher requirements for entry-level roles, while 10% expected fewer junior opportunities to gain foundational experience. Meanwhile, 41% anticipated new roles focused on AI oversight, validation, and orchestration. These are expectations, not evidence that entry-level jobs have already disappeared or that new roles will appear at a particular rate.
What analysts do with AI in live SOC work
A 2025 empirical study offers a view of actual usage, but not a verdict on learning. Researchers examined 3,090 queries from 45 analysts at one enterprise SOC over 10 months, covering live investigations from May 2023 to March 2024 with GPT-4. Common uses included interpreting raw telemetry, refining task-related communications, and getting brief, on-demand help. The authors describe LLMs as tools for sensemaking and context-building, with analysts retaining final judgment. Because this was one organization and the study did not measure skill development or operational performance, it cannot establish industry-wide effects. Singh et al., “LLMs in the SOC”
Rank #2
- Matt-laminated and greaseproof pages ensure glare-free reading and long life
- The outside covers are made from a new rubberized material for better Handling and Grip
- All the Tool Holder Identification Sections now include a full INCH section along with a METRIC section
- Updated and Improved Index Searching
Survey responses about oversight should also be read as stated confidence, not demonstrated accuracy. In Swimlane’s survey, 92% said they were confident they could recognize an incorrect or incomplete AI recommendation, and 48% said they rely on their own judgment when AI conflicts with evidence or could affect critical systems. Those answers do not test whether respondents actually catch errors consistently. Swimlane CISO Mike Lyborg said: “Security teams need to see how a recommendation was reached, understand what action will follow and be able to step in before a consequential decision is made.” He also said: “AI may be taking on more work in the SOC, but accountability still belongs with people.” These are vendor statements; the practical principle is to keep evidence review and human accountability explicit.
What task-performance evidence can—and cannot—show
A separate Cloud Security Alliance announcement reports a benchmark with 148 participants randomly assigned to AI-assisted or manual groups. Participants investigated two escalated alerts: an AWS S3 bucket alert and a Microsoft Entra ID failed-login alert. In those two scenarios, AI-assisted investigations were reported as 45% and 61% faster, and scored 22% and 29% higher in accuracy, respectively. The results concern one AI-enabled platform and two scenarios; they do not show that all SOC tasks become faster or more accurate, nor do they measure whether analysts learn less over time. Cloud Security Alliance benchmark announcement
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How SOC leaders can protect both capacity and learning
The studies do not prove which training or deployment approach works best. Still, the reported tension suggests practical checks for teams introducing AI:
- Keep supervised practice in the workflow. Let analysts work through selected alerts and explain their reasoning, rather than routing every routine case straight to automation.
- Make recommendations auditable. Analysts should be able to inspect the evidence behind an AI conclusion and identify what information is missing.
- Set human approval points. Define which actions require a person to review, approve, or stop the next step, especially when the consequences are significant.
- Match autonomy to experience and task. Decide what the system may handle independently, what requires review, and where junior analysts need hands-on repetitions.
- Measure learning as well as throughput. Track investigation quality, review findings, and analysts’ ability to explain decisions—not only alert volume or time saved.
When evaluating an AI-supported SOC workflow, ask how much routine work it automates versus retains as supervised practice; whether analysts can see the evidence and rationale; how they can pause or override consequential actions; which tasks and experience levels it supports; and whether the organization measures learning alongside speed and quality. The cited studies do not provide a side-by-side comparison of commercial products.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Rank #4
What the evidence supports
Current findings support a narrower conclusion than “AI makes SOC analysts more productive but less skilled.” A vendor-sponsored survey found that respondents reported both skill benefits and constraints, alongside expectations of a more difficult entry path. A field study observed analysts using LLMs mainly for interpretation and communication while retaining decision authority. A limited benchmark reported faster, more accurate work in two alert scenarios. Together, they describe a real workforce and workflow tension, but do not establish that AI causes skill erosion or that the results apply to every SOC.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
